Executive brief
JSONata is a JavaScript library for querying and transforming JSON data through declarative expressions. Before version 2.2.1 and 1.8.8, attackers could craft malicious JSONata expressions that execute arbitrary system code on servers or applications using the library. This allows remote code execution without authentication, potentially leading to complete system compromise, data theft, or service disruption.
Technical details
The vulnerability stems from multiple unsafe design choices in JSONata's expression evaluation engine. Attackers can override the $clone function to mutate internal objects during transform operations, destructure jsonata built-in functions like $merge.* to access lambda internals, and exploit applyProcedure's use of forEach without Array.prototype isolation, enabling prototype pollution. By chaining these primitives, an attacker can escalate from expression manipulation to constructor-based code execution, invoking child_process.execSync or similar Node.js APIs. The attack requires no prior authentication or user interaction—any application accepting untrusted JSONata expressions is vulnerable. Patches were applied via three separate PRs (#799, #800, #802) affecting expression transformation safety, lambda destructuring protection, and procedure argument handling, shipping in JSONata 2.2.1 and backported to 1.8.8.
Affected products
- jsonata-js jsonata >=2.0.0, <2.2.1 and <1.8.8
Timeline
- 2026-07-13: disclosed: JSONata vulnerability initially published
- 2026-07-13: patched: Fixed in JSONata 2.2.1 via PRs #799, #800, #802
- 2026-07-13: patched: Fixes backported to JSONata 1.8.8
- 2026-08-21: advisory: GitHub Advisory Database publication (GHSA-66mm-25pp-rfff, CVE-2026-77415)